Junglewise Threat Intelligence

CVE-2026-34226: capricorn86 Happy DOM cookie leakage in fetch requests

CVE-2026-34226 · Severity: high · CVSS 7.5 · Published 2026-03-27

Technologies: happy-dom (npm). Vendors: Red Hat, npm.

Executive brief

Happy DOM, a tool used to simulate web browser environments for testing and automation, contains a flaw that can leak sensitive login information. When making web requests, the software may incorrectly send cookies belonging to the current page to a completely different destination. This could allow an attacker to intercept session tokens or private user data if they can influence where the software sends its requests.

Technical details

A vulnerability exists in Happy DOM's fetch implementation where the 'credentials: include' option causes the library to attach cookies from the current window.location (Origin A) to a request targeting a different destination (Origin B). The root cause is located in the FetchRequestHeaderUtility and CookieContainer components, which failed to properly validate that cookies matched the target request URL before inclusion. An attacker who can control the destination of a fetch request initiated within a Happy DOM environment can capture cookies belonging to the environment's current origin. This issue is fixed in version 20.8.9 by ensuring cookie matching logic strictly adheres to the target URL.

Affected products

  • capricorn86 happy-dom < 20.8.9
  • Red Hat Red Hat Ansible Automation Platform 2 2

Timeline

  • 2026-03-26: patched: Version 20.8.9 released to address the cookie leakage.
  • 2026-03-27: disclosed: Security advisory published.

References

Related threats